I’m pretty sure CDN images are ok, as WPBeginner’s Twitter cards seem to be working fine and they use a CDN for their images.
However, I did disable my CDN last night trying to get the cards to work. I’ve since figured out that it was my robots.txt file preventing the cards from working, but I’m going to leave it disabled until I get this sorted out.